CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- europa eidas-node integration packageEuropean Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate...9.8 Critical
- europa eidas-node integration packageEuropean Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because...9.8 Critical
- mercurialMercurial Improper Certificate Validation vulnerability5.9 Medium
- vmware vcenter server, vcenter server appliance +1 moreSensitive information disclosure vulnerability resulting from a lack of certificate validation...5.9 Medium
- vmware vcenter server, vcenter server appliance +1 moreSensitive information disclosure vulnerability resulting from a lack of certificate validation...5.9 Medium
- microfocus netiq self service password resetMan-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all...5.9 Medium
- jenkins cadence vmanager, jenkins project cadence vmanager plugin +1 moreJenkins Cadence vManager Plugin disables SSL/TLS and hostname verification8.2 High
- jenkins bumblebee hp alm, jenkins project bumblebee hp alm plugin +1 moreJenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation6.5 Medium
- dogtag jss, jss cryptomanager project cryptomanager, redhat enterprise linux +6 more +8 moreA flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager...6.8 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series: An attacker may be able to perform Man-in-the-Middle (MitM) attacks during app-id signature updates.6.8 Medium
- netapp clustered data ontapClustered Data ONTAP versions 9.0 and higher do not enforce hostname verification under certain...5.9 Medium
- twitter kitThe Twitter Kit framework through 3.4.2 for iOS does not properly validate the api.twitter.com...7.4 High
- jetbrains teamcityAn issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for...7.5 High
- microsoft rome sdk, project rome +1 moreAn information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS...5.9 Medium
- couchbase serverAn issue was discovered in Couchbase Server 5.0.0. When creating a new remote cluster reference...7.5 High
- limesurveyLimesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration.5.3 Medium
- imapfilter project imapfilter, debian linux, fedoraproject fedora +2 more +4 moreIMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.7.5 High
- dell emc enterprise copy data management, dell emc enterprise copy data management (ecdm) +1 moreDell EMC Enterprise Copy Data Management (eCDM) versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a...6.4 Medium
- pw3270 project pw3270There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1.8.1 High
- cisco webex meetings, webex meetings for ios +1 moreCisco Webex Meetings Mobile (iOS) SSL Certificate Validation Vulnerability5.9 Medium
- huawei cloudlink phone 7900, cloudlink phone 7900 firmware +1 moreThe SIP TLS module of Huawei CloudLink Phone 7900 with V600R019C10 has a TLS certificate...6.5 Medium
- uidai maadhaarThe mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation, leading to man-in...7.4 High
- jenkins vmware lab manager slaves, jenkins project vmware lab manager slaves plugin +1 moreJenkins VMware Lab Manager Slaves Plugin vulnerable to Improper Certificate Validation6.5 Medium
- jenkins codefresh integration, jenkins project codefresh integration plugin +1 moreJenkins Codefresh Integration Plugin Improper Certificate Validation vulnerability7.5 High
- open build service build service, opensuse open build service +1 moreMissing TLS certificate validation for HTTPS connections in osc7.4 High
- cpanelIn cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).6.5 Medium
- gnome evolution-ews, redhat enterprise linux +1 moreIt was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An...8.1 High
- dlink 6600-ap firmware, dwl-3600ap firmware, dwl-8610ap firmware +2 moreAn issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019...5.5 Medium
- elastic apm agent for ruby, apm-agent-ruby +1 moreElastic APM agent for Ruby vulnerable to Improper Certificate Validation7.4 High
- opensslWindows builds with insecure path defaults3.3 Low
- http request project request, oss http request (apache cordova plugin) +1 morekevinsawicki/http-request Missing certificate validation5.9 Medium
- cisco industrial network directorCisco Industrial Network Director Web Services Management Agent Unauthorized Information Disclosure Vulnerability5.3 Medium
- helmHelm Improper Certificate Validation9.8 Critical
- microsoft windows, .net framework, identitymodel +58 more +60 moreAn authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and...7.5 High
- cohesity dataplatformA man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform...8.1 High
- mozilla firefoxA vulnerability exists where it possible to force Network Security Services (NSS) to sign...5.3 Medium
- mailvelopeMailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows...4.3 Medium
- mastodon-tootdon tootdon for mastodon, tsukurito, inc. android app 'tootdon for mastodon' +1 moreThe Android App 'Tootdon for Mastodon' version 3.4.1 and earlier does not verify X.509...7.4 High
- cisco web security appliance (wsa), web security appliance, asyncos +2 moreCisco Web Security Appliance HTTPS Certificate Denial of Service Vulnerability8.6 High
- gnupg, sks keyserver project keyserver, f5 traffix signaling delivery controller +2 more +4 moreInteraction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG...7.5 High
- ibm security access managerIBM Security Access Manager 9.0.1 through 9.0.6 does not validate, or incorrectly validates, a...3.7 Low
- asus hivivo, vivobaby +1 moreThe ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation.9.1 Critical
- abb board support package un31, cp620-web firmware, cp620 firmware +5 more +7 moreThe ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its...8.3 High
- asus vivobaby, hivivo +1 moreThe ASUS Vivobaby application before 1.1.09 for Android has Missing SSL Certificate Validation.9.1 Critical
- twistedImproper Certificate Validation in Twisted7.4 High
- keycloak, redhat single sign-on +1 moreImproper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak6.5 Medium
- jenkins electricflow, jenkins project electricflow plugin +1 moreJenkins ElectricFlow Plugin globally and unconditionally disabled SSL/TLS certificate validation6.5 Medium
- samsung galaxy appsSamsung Galaxy Apps before 4.4.01.7 allows modification of the hostname used for load balancing...8.1 High
- hybridgroup gobotHybrid Group Gobot Improper Certificate Validation vulnerability7.5 High
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.2.8 WinCollect could allow an attacker to obtain sensitive information by...5.9 Medium
- Show moreLoading…